Merge pull request #8651 from magento-cia/cia-2.4.7-beta3-develop-bugfix-11302023

Cia 2.4.7 beta3 develop bugfix 11302023

Author: pawan-adobe-security

app/code/Magento/Email/Model/Template/Filter.php

@@ -81,11 +81,6 @@ class Filter extends Template
      */
     protected $_modifiers = ['nl2br' => ''];
 
-    /**
-     * @var string
-     */
-    private const CACHE_KEY_PREFIX = "EMAIL_FILTER_";
-
     /**
      * @var bool
      */
@@ -414,10 +409,6 @@ public function blockDirective($construction)
         $skipParams = ['class', 'id', 'output'];
         $blockParameters = $this->getParameters($construction[2]);
 
-        if (isset($blockParameters['cache_key'])) {
-            $blockParameters['cache_key'] = self::CACHE_KEY_PREFIX . $blockParameters['cache_key'];
-        }
-
         $block = null;
 
         if (isset($blockParameters['class'])) {

dev/tests/integration/testsuite/Magento/Framework/View/Element/AbstractBlockTest.php

@@ -26,6 +26,9 @@ class AbstractBlockTest extends \PHPUnit\Framework\TestCase
      */
     protected $_layout = null;
 
+    /**
+     * @var array
+     */
     protected static $_mocks = [];
 
     /**
@@ -573,7 +576,7 @@ public function testGetCacheKey()
         $this->assertNotEquals($name, $key);
 
         $block->setCacheKey('key');
-        $this->assertEquals(AbstractBlock::CACHE_KEY_PREFIX . 'key', $block->getCacheKey());
+        $this->assertEquals(AbstractBlock::CUSTOM_CACHE_KEY_PREFIX . 'key', $block->getCacheKey());
     }
 
     /**

lib/internal/Magento/Framework/View/Element/AbstractBlock.php

@@ -12,6 +12,7 @@
 use Magento\Framework\Cache\LockGuardedCacheLoader;
 use Magento\Framework\Config\ConfigOptionsListConstants;
 use Magento\Framework\DataObject\IdentityInterface;
+use Magento\Framework\Exception\RuntimeException;
 
 /**
  * Base class for all blocks.
@@ -41,6 +42,11 @@ abstract class AbstractBlock extends \Magento\Framework\DataObject implements Bl
      */
     public const CACHE_KEY_PREFIX = 'BLOCK_';
 
+    /**
+     * Prefix for custom cache key of block
+     */
+    public const CUSTOM_CACHE_KEY_PREFIX = 'CUSTOM_BLOCK_';
+
     /**
      * @var \Magento\Framework\View\DesignInterface
      */
@@ -1038,11 +1044,16 @@ public function getCacheKeyInfo()
      * Get Key for caching block content
      *
      * @return string
+     * @throws RuntimeException
      */
     public function getCacheKey()
     {
         if ($this->hasData('cache_key')) {
-            return static::CACHE_KEY_PREFIX . $this->getData('cache_key');
+            if (preg_match('/[^a-z0-9\-\_]/i', $this->getData('cache_key'))) {
+                throw new RuntimeException(__('Please enter cache key with only alphanumeric or hash string.'));
+            }
+
+            return static::CUSTOM_CACHE_KEY_PREFIX . $this->getData('cache_key');
         }
 
         /**

lib/internal/Magento/Framework/View/Test/Unit/Element/AbstractBlockTest.php

@@ -15,6 +15,7 @@
 use Magento\Framework\Config\View;
 use Magento\Framework\Escaper;
 use Magento\Framework\Event\ManagerInterface as EventManagerInterface;
+use Magento\Framework\Exception\RuntimeException;
 use Magento\Framework\ObjectManagerInterface;
 use Magento\Framework\Session\SessionManagerInterface;
 use Magento\Framework\Session\SidResolverInterface;
@@ -239,7 +240,21 @@ public function testGetCacheKey()
     {
         $cacheKey = 'testKey';
         $this->block->setData('cache_key', $cacheKey);
-        $this->assertEquals(AbstractBlock::CACHE_KEY_PREFIX . $cacheKey, $this->block->getCacheKey());
+        $this->assertEquals(AbstractBlock::CUSTOM_CACHE_KEY_PREFIX . $cacheKey, $this->block->getCacheKey());
+    }
+
+    /**
+     * Test for invalid cacheKey name
+     * @return void
+     * @throws RuntimeException
+     */
+    public function testGetCacheKeyFail(): void
+    {
+        $cacheKey = "test&''Key";
+        $this->block->setData('cache_key', $cacheKey);
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage((string)__('Please enter cache key with only alphanumeric or hash string.'));
+        $this->block->getCacheKey();
     }
 
     /**